Vulnerability Details : CVE-2011-1689
Multiple cross-site scripting (XSS) vulnerabilities in Best Practical Solutions RT 2.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2011-1689
Probability of exploitation activity in the next 30 days: 0.30%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 66 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2011-1689
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2011-1689
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-1689
-
http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000188.html
[Rt-announce] RT 3.8.10 Released - Security ReleasePatch
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/66796
Best Practical Solutions RT unspecified cross-site scripting CVE-2011-1689 Vulnerability Report
-
http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000189.html
[Rt-announce] RT 3.6.11 Released - Security ReleasePatch
-
http://www.securityfocus.com/bid/47383
RT Versions Prior to 3.6.11/3.8.10 Multiple Remote Vulnerabilities
-
http://www.debian.org/security/2011/dsa-2220
Debian -- Security Information -- DSA-2220-1 request-tracker3.6, request-tracker3.8
-
http://www.vupen.com/english/advisories/2011/1071
Webmail | OVH- OVH
-
https://bugzilla.redhat.com/show_bug.cgi?id=696795
696795 – (CVE-2011-1685, CVE-2011-1686, CVE-2011-1687, CVE-2011-1688, CVE-2011-1689, CVE-2011-1690) CVE-2011-1685 CVE-2011-1686 CVE-2011-1687 CVE-2011-1688 CVE-2011-1689 CVE-2011-1690 rt3: several secPatch
-
http://lists.bestpractical.com/pipermail/rt-announce/2011-April/000187.html
[Rt-announce] Security vulnerabilities in RTPatch
-
http://blog.bestpractical.com/2011/04/security-vulnerabilities-in-rt.html
Not Found — Best Practical Solutions
Products affected by CVE-2011-1689
- cpe:2.3:a:bestpractical:rt:3.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.0.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.6.8:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.6.9:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.9:rc3:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.9:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.9:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.6:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.7:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.6:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.8:rc3:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.8:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.9:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.8:rc4:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.7:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.8.8:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:rc5:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:rc6:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:4.0.0:rc7:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:3.6.10:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.15:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:bestpractical:rt:2.0.5:*:*:*:*:*:*:*